How to Build a Conformant C2PA Generator Product

The first step is to design your Generator Product. Here are some decisions you need to make:

If you are not sure, Trufo offers one complimentary consultation.

For Level 2, you will need to demonstrate hardware key security, and this involves working with the CA to submit the proper attestation documents when requesting certificates.

Once you have decided on what to build, you need to pass through the C2PA Conformance Program, which involves putting together a security architecture document and providing evidence of functionality via samples. The c2pa-rs library is a good starting point (though it is often insufficient on its own). You will need to implement the sections of the C2PA specifications that are relevant to you. The specifications are long (hundreds of pages of material), so be prepared to sink some time into understanding how C2PA works. For sample generation, we recommend using a test certificate. Once your application is submitted, the process can take anywhere between 1 week and 3 months.

Once you have obtained approval, you will need to find a CA to purchase a certificate. This CA needs to be on the C2PA Trust List. Popular CAs include Trufo, DigiCert, and SSL.com. You will need to pass Organization Validation (OV) and Product Validation (PV). The former certifies your legal entity, and the latter certifies your CPL record. This usually takes a few days. Then, you need to generate your secure key (ideally in a FIPS 140-3 Level 2+ HSM or equivalent) and make a CSR to the CA to obtain your certificate. The exact process differs by CA, but for most, a well-designed API will be critical for a smoothly-running production C2PA system.

Trufo’s certificate procurement process is documented publicly at trufo-py.

You will also need timestamping and OCSP stapling. These are required in order for Content Credentials to remain valid after the certificate expires; after all, unlike HTTPS where network traffic is received immediately after it is signed, oftentimes content is consumed many years after it is created.

• There are a number of C2PA Timestamping Authorities (TSAs) who provide timestamping services, including Trufo, DigiCert, and SSL.com. For free timestamping (not C2PA-trusted), Trufo and DigiCert provide endpoints.
• OCSP stapling needs to be implemented in your C2PA manifest construction. The C2PA CAs will provide OCSP response endpoints for you to query (and cache) to execute OCSP stapling.

Lastly, if you want individual or organization identity, you will need a CAWG certificate. Currently, the CAWG trust model is still in an interim phase. There are a few trust providers you can use: Trufo, Pixelstream (ICA only), SSL.com (S/MIME only). We expect that CAWG will enter a mature state by the end of the year.

Once you have everything set up, you will need to productionize the Generator Product. The C2PA specifications are still evolving (though as of late 2026 it is now quite stable), and you may want to add more features. When this happens, you will need to go through the above process again.

One aspect of C2PA that will likely become much more relevant in the near future is soft bindings, a.k.a. watermarks. The EU AI Act heavily encourages these (though zero-bit watermarks also work), and new legislation in the US is also near at hand. Providers of soft-binding solutions for C2PA include Trufo (image, audio, video), Imatag (image, video), and Digimarc (image, audio, video).

Putting all this together requires a team of engineers. There are also vendors that provide C2PA signing services, some targeting individuals such as ProofMode with their camera app and others targeting enterprise such as Trufo with their API/SDK suite.

For a simple Level 1 Generator Product that signs 1 million images a year with no watermarks, the estimated costs are: